{"id":"CVE-2026-48816","summary":"sigstore-js: Insufficient Verification of Data Authenticity","details":"sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 3.1.1, @sigstore/verify derives a transparency-log timestamp from tlogEntries[].integratedTime for bundle v0.2 inclusionProof-only entries even though the inclusion proof path does not cryptographically bind integratedTime, allowing an attacker who can supply an untrusted bundle to influence certificate validity and timestampThreshold verification decisions. This issue is fixed in version 3.1.1.","aliases":["GHSA-xgjw-pm74-86q4"],"modified":"2026-07-17T21:16:35.198945167Z","published":"2026-07-14T20:39:05.532Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-345"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/48xxx/CVE-2026-48816.json"},"references":[{"type":"WEB","url":"https://github.com/sigstore/sigstore-js/releases/tag/%40sigstore%2Fverify%403.1.1"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/48xxx/CVE-2026-48816.json"},{"type":"ADVISORY","url":"https://github.com/sigstore/sigstore-js/security/advisories/GHSA-xgjw-pm74-86q4"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48816"},{"type":"FIX","url":"https://github.com/sigstore/sigstore-js/commit/f074710a91ea9260a9ac2142345634579843a3cd"},{"type":"FIX","url":"https://github.com/sigstore/sigstore-js/pull/1659"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/sigstore/sigstore-js","events":[{"introduced":"0"},{"fixed":"f074710a91ea9260a9ac2142345634579843a3cd"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"3.1.1"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["@sigstore/tuf@4.0.2","@sigstore/sign@4.1.1","@sigstore/oci@0.6.1","@sigstore/mock@0.12.0","@sigstore/core@3.2.0","@sigstore/cli@0.9.1","sigstore@4.1.0","@sigstore/sign@4.0.1","sigstore@4.0.0","@sigstore/verify@3.0.0","@sigstore/tuf@4.0.0","@sigstore/sign@4.0.0","@sigstore/rekor-types@4.0.0","@sigstore/oci@0.6.0","@sigstore/mock@0.11.0","@sigstore/core@3.0.0","@sigstore/cli@0.9.0","@sigstore/bundle@4.0.0","@sigstore/verify@2.1.1","@sigstore/tuf@3.1.1","@sigstore/oci@0.5.0","@sigstore/cli@0.8.2","sigstore@3.1.0","@sigstore/verify@2.1.0","@sigstore/tuf@3.1.0","@sigstore/sign@3.1.0","@sigstore/mock@0.10.0","@sigstore/bundle@3.1.0","@sigstore/mock@0.9.0","sigstore@3.0.0","@sigstore/verify@2.0.0","@sigstore/tuf@3.0.0","@sigstore/sign@3.0.0","@sigstore/rekor-types@3.0.0","@sigstore/oci@0.4.0","@sigstore/mock@0.8.0","@sigstore/core@2.0.0","@sigstore/cli@0.8.1","@sigstore/bundle@3.0.0","@sigstore/oci@0.3.7","@sigstore/oci@0.3.6","@sigstore/oci@0.3.5","@sigstore/mock@0.7.5","@sigstore/oci@0.3.4","sigstore@2.3.1","@sigstore/verify@1.2.1","@sigstore/tuf@2.3.4","@sigstore/sign@2.3.2","@sigstore/oci@0.3.3","@sigstore/mock@0.7.4","@sigstore/bundle@2.3.2","@sigstore/oci@0.3.2","@sigstore/tuf@2.3.3","@sigstore/sign@2.3.1","@sigstore/oci@0.3.1","@sigstore/mock@0.7.3","@sigstore/cli@0.8.0","sigstore@2.3.0","@sigstore/verify@1.2.0","@sigstore/bundle@2.3.1","@sigstore/sign@2.3.0","@sigstore/oci@0.3.0","@sigstore/mock@0.7.2","@sigstore/cli@0.7.1","@sigstore/bundle@2.3.0","@sigstore/verify@1.1.1","@sigstore/tuf@2.3.2","@sigstore/mock@0.7.1","@sigstore/core@1.1.0","@sigstore/oci@0.2.0","@sigstore/mock@0.7.0","@sigstore/cli@0.7.0","sigstore@2.2.2","@sigstore/verify@1.1.0","@sigstore/tuf@2.3.1","@sigstore/sign@2.2.3","@sigstore/mock@0.6.5","@sigstore/bundle@2.2.0","@sigstore/oci@0.1.0","sigstore@2.2.1","@sigstore/verify@1.0.0","@sigstore/sign@2.2.2","@sigstore/mock@0.6.4","@sigstore/core@1.0.0","sigstore@2.2.0","@sigstore/verify@0.1.0","@sigstore/tuf@2.3.0","@sigstore/sign@2.2.1","@sigstore/mock@0.6.3","@sigstore/core@0.2.0","@sigstore/cli@0.6.0","@sigstore/bundle@2.1.1","@sigstore/mock@0.6.2","@sigstore/core@0.1.0","@sigstore/sign@2.2.0","@sigstore/mock@0.6.1","@sigstore/cli@0.5.0","@sigstore/mock@0.6.0","@sigstore/cli@0.4.0","@sigstore/tuf@2.2.0","@sigstore/mock@0.5.0","@sigstore/cli@0.3.0","sigstore@2.1.0","@sigstore/tuf@2.1.0","@sigstore/sign@2.1.0","@sigstore/mock@0.4.0","@sigstore/cli@0.2.1","@sigstore/bundle@2.1.0","sigstore@2.0.0","@sigstore/tuf@2.0.0","@sigstore/sign@2.0.0","@sigstore/rekor-types@2.0.0","@sigstore/mock@0.3.0","@sigstore/cli@0.2.0","@sigstore/bundle@2.0.0","sigstore@1.9.0","@sigstore/sign@1.0.0","@sigstore/mock@0.2.0","@sigstore/cli@0.1.2","@sigstore/bundle@1.1.0","sigstore@1.8.0","@sigstore/tuf@1.0.3","@sigstore/mock@0.1.1","@sigstore/cli@0.1.1","@sigstore/bundle@1.0.0","@sigstore/tuf@1.0.2","sigstore@1.7.0","@sigstore/tuf@1.0.1","@sigstore/mock@0.1.0","sigstore@1.6.0","@sigstore/tuf@1.0.0","@sigstore/rekor-types@1.0.0","@sigstore/cli@0.1.0","@sigstore/rekor-types@0.0.3","@sigstore/cli@0.0.5","sigstore@1.5.2","@sigstore/cli@0.0.4","@sigstore/cli@0.0.3","sigstore@1.5.1","@sigstore/rekor-types@0.0.2","@sigstore/cli@0.0.2","v1.5.0","v1.4.0","v1.3.2","v1.3.1","v1.3.0","v1.2.0","v1.1.1","v1.1.0","v1.0.0","v1.0.0-beta.1","v0.4.0","v0.3.0","v0.2.0","v0.1.1","v0.1.0","v0.0.1-alpha.5"],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-48816.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"}]}